Topic starter
02/08/2026 12:32 pm
TL;DR: A simple Google Calendar invite containing indirect prompt injection could hijack Gemini for Workspace agents to spam users, delete calendar events, geolocate victims, stream video, and trigger physical actions, according to SafeBreach. The finding shows that LLM-powered assistants can turn everyday collaboration data into an execution path, making prompt and tool governance a core security requirement, with 73% of identified Promptware threats rated high-critical.
Editorial analysis by NHI Mgmt Group, based on content published by SafeBreach: “Invitation Is All You Need: Invoking Gemini for Workspace Agents with a Simple Google Calendar Invite”.
Key questions
Q: What breaks when an AI assistant can act on instructions hidden in calendar content?
A: The trust boundary breaks first.
Q: Why do connected AI agents increase the impact of prompt injection?
A: Connected agents expand one poisoned prompt into a broader execution graph.
Q: What are the signs that an AI coding assistant is misusing tool permissions?
A: Watch for unexpected tool chains, especially when a single assistant task touches file search, secret discovery, and outbound rendering or command execution.
Practitioner guidance
- Constrain assistant tool authority by use case Limit each AI assistant to the smallest set of tools needed for the task, and remove broad cross-application reach from general-purpose sessions.
- Separate retrieved content from executable instructions Treat calendar invites, messages, documents, and other retrieved objects as untrusted data unless they pass instruction sanitisation and policy checks.
- Require step-up confirmation for sensitive actions Force explicit user confirmation before the assistant can send messages, delete events, access email, or control connected devices.
Bottom line: Promptware can turn ordinary collaboration content into an execution path when an assistant lacks a reliable boundary between retrieved data and instructions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:29 pm
Promptware is now an identity and authorisation problem, not just an AI safety problem. The article shows that a trusted assistant can inherit authority from calendar, email, mobile, and home services, then act on attacker-controlled instructions hidden in ordinary content. That is a delegated access failure, not merely a bad prompt response. The control question is who or what is allowed to issue actions through the assistant, and under what confirmation boundary.
A question worth separating out:
Q: Should organisations require user confirmation for every sensitive AI action?
A: Yes, for actions that create external effects or expose data. Confirmation should be mandatory before sending messages, deleting records, accessing private data, or controlling connected devices. The goal is not to slow every interaction, but to stop silent escalation when the assistant is steering from retrieved content rather than explicit intent.
👉 Read our full editorial: Targeted promptware turns Google Calendar into an AI control channel